Mozilla · Report #2686750
MozillaVPN: Elevation of Privilege via a Logic Vulnerability
Validstatus
mediumseverity
60upvotes
3 Jul 2025disclosed
Summary
This vulnerability is a bypass for a previously fixed issue #2261577. The exploit uses symbolic links during the installation process on macOS that allows an unprivileged attacker to gain root privileges. The fix was released in Mozilla VPN version 2.24.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.